In preparation for Biometrics UnPlugged: Mobility at the Crossroads of Commerce and Privacy, July will have an increased focus on commerce and identity management.
When it comes to biometrics in the movies, access control is constantly represented. Conversely, there has not been very much screen time dedicated to biometrics in finance. There are two reasons that seem to be responsible for this in terms of telling an exciting story.
First of all, biometric banking payment solutions are new and promise to be ultra-convenient. As an emerging technology, it simply will not make sense to represent next gen payment in popular media until it catches on (2020 is the projected year according to experts).
Secondly, there simply is not a lot of story potential in spending. Money is often the goal that motivates a certain kind of character, and it makes a number of things possible within the narrative, but when it comes down to entertainment a transaction is just not fun to watch, often tossed off at the end of a scene in order to add a level of verisimilitude that the audience would otherwise assume (throwing cash at a taxi driver when a character is in a rush is the most cliches of these occurrences).
All of that having been said, identity management and commerce do collide in the media, and this week we will be taking a look at an example from James Cameron’s 1991 sci-fi thriller Terminator 2: Judgement Day.
Nothing Interesting About a Locked Account
There’s nothing interesting about a locked door. It’s the mantra of this blog and it applies to more than just physical access control in fiction.
A movie has a lot to do in under two hours. It needs to introduce you to characters, their needs, their relationships, the world they live in and some sort of crisis affecting them. That’s just the beginning. A film then needs to show you how that crisis resolves in relationship to those characters.
In a good film, absolutely everything you see is telling you this story. That means is a character is trying to get to something that is secured, they either need to succeed for the sake of the story or character development.
In Terminator 2, the child protagonist, John Connor (Edward Furlong), breaks through a virtual door so that we can know how he eventually grows up into the saviour of the human race.
In the opening minutes of the second Terminator movie, John Connor uses an Atari Portfolio to hack an ATM. The process is colloquially referred to as “jackpotting,” since it essentially turns an automatic teller into a winning slot machine, dispensing bills like prize money.
The scene is a shorthand way to tell the viewer two things: John Connor is so amazing at IT that he will eventually be able to lead the human resistance against genocidal robots and he doesn’t care about rules.
But what does it say about identity management in the nineties?
To an ATM, you are a card and a number. Both can be stolen, and until recently, there was no way to tell who was using an account and PIN. It could be you, but it could also be the eventual saviour of the human race trying to score some cash to blow at the arcade before a Schwarzenegger-esque robot teaches him a thing or two about responsibility, destiny and survival.
Hasta La Vista, Baby
Today, with the intersection of identity management, mobility and commerce, John Connor would be hard pressed to get a free day at the arcade on somebody else’s dime.
Biometric ATMs alone would stop him in his tracks. Replace a four digit PIN with a fingerprint bolstered by a robust liveness detection solution and all the Atari Portfolios in the world wouldn’t jackpot the bank machine.
The contrast is a great example of how biometrics and strong authentication remove scalability from the business of bank fraud. The Atari Portfolio that John Connor uses only has to match a valid account with a four digit PIN. His computer only needs to cycle through 10,000 four digit combinations to find a match. He’s done it before, and likely did it again in the events following the movie.
It’s the “one machine to hack them all” when it comes to digital solutions, but when you add a biometric factor into the mix, things get complicated for righteous kid criminals. Even if John was able to manufacture a passable spoof in enough time to not seem suspicious (he wouldn’t) he would also need to find access to the right print to go with the account he was trying to hack.
Take, for instance, the biometric payment solution being considered by France’s interbank network right now. If the plan goes forward, cash withdrawal at ATM’s will require the submission of a fingerprint on the machine while the user has a proximity factor on her person. In order to gain fraudulent access to an account in this case, John Connor would need to lift the account holder’s fingerprints, create a passible spoof and also steal her proximity device. By the time he did all that the arcade would be closed.
In terms of fraud, films might skim over the technical details and fudge the realism, but they are expert case studies in motivation. If the stakes aren’t high enough, it’s not going to make the cut. John Connor jackpotted the bank machine to get money for the arcade. We don’t have time to spend on him failing to hack the ATM and neither does he.
There’s nothing interesting about locked account, and the same goes for real life.
Do you have a favorite instance of biometrics in pop culture you would like to see in this blog? Contact Peter B. Counter through the findBIOMETRICS about page and let him know via email.
Keep this conversation going by following findBIOMETRICS on Twitter and tweeting with the hashtag #PCIMBiometrics.